pronto185.com

Monthly Archives: January 2015

Once again I made it to ShmooCon, and once again I didn’t make it to most of the talks I wanted to. Instead I valued talking with people. Caught up with some amazing friends/acquaintances to hear the fun things they’re working on. Also met some new people! A few of them whose first hacker-con was this very ShmooCon. It’s amazing what you can learn just by hanging out in the chill-out room, hotel-bar, lobby, and the various room-parties.

If I met you this past weekend at shmoo, and you want to follow up on anything we discussed please leave comment here or email me at (justin@ifconfig.pro).

Talks I did make:

httpscreenshot – A Tool for Both Teams – Steve Breen and Justin Kennedy

httpscreenshot is a tool developed internally over the past year and a half. It has become one of our go to tools for the reconnaissance phase of every penetration test. The tool itself takes a list of addresses, domains, URLs, and visits each in a browser, parses SSL certificates to add new hosts, and captures a screenshot/HTML of the browser instance. Similar tools exist but none met our needs with regards to speed (threaded), features (JavaScript support, SSL auto detection and certificate scraping), and reliability.

In this talk, I’ll be discussing my experience developing intelligence-gathering capabilities to track several different independent groups of threat actors on a very limited budget (read: virtually no budget whatsoever). I’ll discuss discovering the groups using open source intelligence gathering and honeypots, monitoring attacks, collecting and analyzing malware artifacts to figure out what their capabilities are, and reverse engineering their malware to develop the capability to track their targets in real time. Finally, I’ll chat about defensive strategies and provide recommendations for enterprise security analysts and other security researchers. I’ll also be releasing a suite of tools I created to help threat researchers perform tracking and attribution.

Andrew is someone who I first met at NovaHackers, and when I first met him I thought “This is someone to keep an eye on, he’s going to be doing some pretty awesome things”. Well Andrew, you have!
This talk had specific interest to me as one of my own projects is kinda about doing threat-Intel cheaply.

Firetalks!

Firetalks an event put on by @grecs of NovaInfosec. It’s a great event and I highly recommend attending. They’re short talks on people neat-projects/ideas, right to the good info with out a bunch of unneeded filler talk. My thoughts on each in sub-bullets
Watch the talks on irongeek.com here

Disclaimer, I was in a bit of a ‘oh god what just happened’ while watching this talk

…my talk was the first talk I’ve given

He brings up a LOT of really good points about how IP addressing is handled

If you’re at all interested in how the Internet works(and how it’s broken) watch this

Parties: this year I didn’t do the normal loud crazy parties, but instead went to ‘social gathering’ parties. I Was invited to REDLattice party, was promised good discussion and free beer. They delivered on both, if you get a chance to, go check them out in the future shmoocons to talk to some great people they invite. Also found myself at the #MexiCon party put on by ViciousData (they also sponsored shmoocon epilogue). Was also able to have some really fun and interesting conversations there.

People: Was able to put a lot of faces-to-names this year from irc/twitter folk, that’s always awesome. Though chances are if we meet again, you’ll have to remind me (I’m horrible at remembering names/faces, I remember things/events).
Unfortunately I also meant to meet up with a lot of people who were also there, but we missed each other :( oh well, there’s always the next hackercon!